CVE-2023-3691

layui HTML Attribute cross site scripting

State: Published
Severity: 3.5 Low
Published: Jul 16, 2023
Updated: Oct 23, 2024
Reserved: Jul 15, 2023

Description

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting

Affected Products

Product	Versions
layuin/a	v2.8.0-rc.0Affected v2.8.0-rc.1Affected v2.8.0-rc.2Affected v2.8.0-rc.3Affected v2.8.0-rc.4Affected v2.8.0-rc.5Affected v2.8.0-rc.6Affected v2.8.0-rc.7Affected v2.8.0-rc.8Affected v2.8.0-rc.9Affected v2.8.0-rc.10Affected v2.8.0-rc.11Affected v2.8.0-rc.12Affected v2.8.0-rc.13Affected v2.8.0-rc.14Affected v2.8.0-rc.15Affected v2.8.0-rc.16Affected

References

https://vuldb.com/?id.234237vdb-entrytechnical-description
https://vuldb.com/?ctiid.234237signaturepermissions-required
https://gitee.com/layui/layui/issues/I7HDXZissue-tracking
https://gitee.com/layui/layui/tree/v2.8.0patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.